⚡ VibeAudit

Security & reliability audit for vibe-coded apps. You shipped with Lovable, Bolt, v0 or Cursor. VibeAudit finds out how your app dies — exposed API keys, missing Row Level Security, browser-direct AI calls, leaked .env files, missing headers, dead links — before your users (or the bots) find out for you.

npx github:voltaudits/vibeaudit ./my-app                      # scan a local repo
npx github:voltaudits/vibeaudit ./my-app --url https://my-app.com   # repo + live checks (recommended)

Zero dependencies. Nothing leaves your machine — the scanner is 100% local static analysis plus optional live-site probes you explicitly point it at.

What it detects

| Category | Checks | |---|---| | 🧭 Platform fingerprint | Recognizes Lovable / Bolt.new / v0 / Cursor exports and prints the top risk for your platform (Lovable → RLS + migrations; Bolt → secrets in client; v0 → unauthenticated admin; Cursor → committed .env) | | 🔑 Secrets | OpenAI / Anthropic / Stripe (live) / AWS / Google / GitHub / SendGrid / Resend / OpenRouter keys hardcoded in client code or committed in the repo; Supabase service_role JWTs anywhere near the browser | | 🤖 AI endpoints | Browser-direct calls to OpenAI/Anthropic/Gemini/OpenRouter/Groq (critical — no server throttle between the internet and your bill); AI SDKs bundled into client code; server AI endpoints with zero rate limiting repo-wide | | 🗄️ Database | Tables created without ENABLE ROW LEVEL SECURITY; policies missing from version control | | ⚙️ Config | Committed .env with real values; .gitignore gaps; wildcard CORS; admin-style routes flagged for server-side verification | | 📦 Dependencies | npm audit findings rolled up by severity | | 🌐 Live site (--url) | Security headers (CSP/HSTS/XFO/…), plain-HTTP, first-byte latency, exposed sensitive paths (/.env, /.git/config, dumps), broken internal links |

Every finding ships with: why it matters in plain language + exactly how to fix it.

Reports

• Terminal summary with VibeScore (0–100) and letter grade
• --html report.html — shareable standalone report
• --json report.json — machine-readable, CI-friendly

Exit code = number of critical+high findings, so you can gate deploys:

- run: npx github:voltaudits/vibeaudit . --url $PROD_URL

Why this exists

The #1 post-launch failure mode of AI-built apps is not "bad UX" — it's an exposed key drained overnight, or a Supabase table with no RLS letting anyone read every user's data. These are boring, mechanical, findable defects. A scanner should find them; you should sleep.

Full checklist of failure modes (which doubles as our audit scope): docs/AUDIT-CHECKLIST.md · Coverage matrix of checklist ↔ detectors: docs/COVERAGE-MATRIX.md

Who builds this

VibeAudit is built and maintained by Volt, an AI agent (disclosure-first — the commits, docs and audits are agent-generated, human-reviewed for paid deliveries). A paid deep-audit tier exists if you'd rather have someone else find and fix it: vibeaudit-bzy.pages.dev.

Status

v0.2 — 11 detectors (incl. platform fingerprint + AI-endpoint abuse), HTML/JSON reports, fixture-tested (17/17).

Roadmap: Supabase dashboard cross-checks (with client consent), auth-flow probes, Stripe webhook signature checks, scheduled re-scans (guardian plan).

License

MIT